CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-3993 – Insertion of Sensitive Information into Log File in GitLab
https://notcve.org/view.php?id=CVE-2023-3993
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones a partir de la 14.3 antes de la 16.0.8, a todas las versiones a partir de la 16.1 antes de la 16.1.3, a todas las versiones a partir de la 16.2 antes de la 16.2.2. Es posible que se hayan registrado tokens de acceso al realizar una consulta a un endpoint específico. • https://gitlab.com/gitlab-org/gitlab/-/issues/409570 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3994 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3994
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 9.3 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. Una Denegación de Servicio de Expresión Regular era posible a través del envío de payloads elaborados que utilizan ProjectReferenceFilter al endpoint preview_markdown. • https://gitlab.com/gitlab-org/gitlab/-/issues/416225 https://hackerone.com/reports/1963255 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-0632 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-0632
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 15.2 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. Una denegación de servicio de expresión regular era posible mediante el uso de cargas útiles crafteadas para buscar en Harbor Registry. • https://gitlab.com/gitlab-org/gitlab/-/issues/390148 https://hackerone.com/reports/1852677 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2023-1210 – Generation of Error Message Containing Sensitive Information in GitLab
https://notcve.org/view.php?id=CVE-2023-1210
An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 12.9 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. Era posible filtrar el correo electrónico de un usuario a través de un mensaje de error para los grupos que restringen la pertenencia por dominio de correo electrónico. • https://gitlab.com/gitlab-org/gitlab/-/issues/394775 https://hackerone.com/reports/1884672 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 1CVE-2023-2164 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2023-2164
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 15.9 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. Era posible para un atacante desencadenar una vulnerabilidad XSS almacenada a través de la interacción del usuario con una URL crafteada en la beta WebIDE. • https://gitlab.com/gitlab-org/gitlab/-/issues/407783 https://hackerone.com/reports/1940598 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •